Concrete CMS Stored XSS in the Search Field

2024-04-0321:31:41

CWE-20

CWE-79

GitHub Advisory Database

github.com

concrete cms

vulnerability

stored xss

search field

CVSS3

3.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L

AI Score

5.7

Confidence

High

EPSS

Percentile

9.0%

JSON

Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. Prior to the fix, stored XSS could be executed by an administrator changing a filter to which a rogue administrator had previously added malicious code. The Concrete CMS security team gave this vulnerability a CVSS v3.1 score of 3.1 with a vector of AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator . Thanks Alexey Solovyev for reporting

Affected configurations

Vulners

Node

concrete5concrete5Range<8.5.16

concrete5concrete5Range9.0.0RC1–9.2.8

VendorProductVersionCPE
concrete5concrete5*cpe:2.3:a:concrete5:concrete5:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
concrete5	concrete5	*	cpe:2.3:a:concrete5:concrete5::::::::

References

documentation.concretecms.org/9-x/developers/introduction/version-history/928-release-notes?_gl=1*1bcxp5s*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY2ODEuMC4wLjA.

documentation.concretecms.org/developers/introduction/version-history/8516-release-notes?_gl=1*1oa3zn1*_ga*MTc1NDc0Njk2Mi4xNzA2ODI4MDU1*_ga_HFB3HPNNLS*MTcxMjE2NjYyNi4xMy4xLjE3MTIxNjY3MDcuMC4wLjA.

github.com/advisories/GHSA-qgm9-rxmq-jxmq

github.com/concretecms/concretecms/commit/822e689cefe1eb876e9de31dad9ce660f3b5c295

github.com/concretecms/concretecms/commit/e85ef2408a5eea7d5646178fbef0ab243baaed8f

nvd.nist.gov/vuln/detail/CVE-2024-3181